A free check of what your website shows the public internet
Enter your web address. The scan reads ten areas of your site’s public setup, gives it a grade, and lists the fixes in order of importance. It takes under a minute, with no signup and no card.
No card and no signup. We do not store the address you scan or its result in any database.
What the scan checks
Ten areas, read from what your website and your DNS records show anyone. Each problem it finds comes with the fix.
- SSL and HTTPS
- Your certificate is valid and the connection is encrypted. The TLS version is inferred from your CDN, not measured.
- Security headers
- The instructions your site gives browsers to block common attacks: HSTS and CSP (scored by how strict they are), clickjacking protection, COOP, CORP and others.
- HTTPS redirect
- A visitor who types http:// is sent to the encrypted site.
- Email security
- Whether someone else can send email that claims to be from your domain: SPF and DMARC and how strict they are, DKIM, MTA-STS and TLS-RPT.
- Content files
- robots.txt and sitemap.xml are present.
- Cookies
- Your cookies carry the Secure, HttpOnly and SameSite flags.
- Performance
- Response time, compression, caching and page size.
- Advanced checks
- CORS settings, mixed content, published source maps, information your server gives away, and open redirects.
- DNS
- DNSSEC, CAA records, mail (MX) records and name-server redundancy.
- Exposed files and versions
- Files that should never be public (such as .env and .git), CMS and library versions with known problems, subdomain takeover, leaked keys and debug pages. A missing page is never reported as a finding.
What the scan sends, and to whom
At most 42 requests in all, DNS lookups included. None of them logs in, fills in a form or is designed to change anything.
- Your website
- Your home page, over HTTPS and over plain HTTP to see the redirect, then robots.txt, sitemap.xml and up to two of the page’s own script files. It asks for files that should never be public (/.env, /.git/HEAD, /.git/config, /wp-config.php.bak, /actuator/env and /metrics), checks whether /uploads/ or /backup/ list their contents, and asks for /.well-known/security.txt, which should be public. It asks /graphql to describe itself, in case you run one, and asks for one made-up address to compare the answers against.
- Test requests
- An OPTIONS and a TRACE request, to see which methods your server accepts. Two requests that say they come from somewhere other than your site, to check your CORS settings. Your home page once with a harmless test word in the link and once with a made-up redirect address, to see whether either comes back unsafely.
- Your other addresses
- www, api, staging and dev on your domain, only when your DNS points one of them at another service, to check that nobody else could take it over.
- Google Public DNS
- Your domain’s public records (mail, security, address and name-server records) are looked up through Google Public DNS (dns.google), so Google receives the domain you scan.
What we keep, and for how long
- On our server
- A count of scans from your IP address, kept for up to an hour to hold the limit of 10 scans an hour, then deleted. We do not store the address you scan or its result in any database.
- In Cloudflare’s request logs
- Like every request to this site, your scan is logged with your IP address for up to 7 days, so we can find faults. The address you scan is in those logs when it is part of the link (ghosts.lk/scan?url=example.com, which is what the scan box sends if the page’s scripts have not loaded), and when we refuse to scan it, for example a private network address.
- In your browser
- Your last result, for as long as this tab is open, and a list of your last 20 scans. They are stored on your device, not ours.
- If you ask our assistant
- When you open the chat and ask a question, your last result is sent with it, so the assistant can answer about your site.
A scan is not a penetration test
The scan reads what your site shows publicly, with the requests listed above. It never logs in, and it cannot see flaws in how your application works, such as one customer reaching another’s data. A high grade means the surface is well configured, not that the application was tested. When you need that, there are two steps up.
- Ghost Scan Free
- The ten-area surface check on this page, in under a minute.
- Security scan $299
- PhantomDragon’s 75+ scanner modules against your site or app, covering the OWASP Top 10, with the output read by an engineer and a PDF report in 48 hours. See pricing
- Penetration test $4,000
- A named engineer tries to break in: logins, permissions and business logic, with a free re-test after you fix and a signed attestation letter, in 5 to 7 days. How a pentest works
Launching soon? Read penetration testing before launch.
Common questions
Is this really free?
Yes: basic security scans are free forever. No signup, no credit card, no catch. We built this to help make the web safer.
What does the free scan check?
This website security checker runs ten categories of checks: SSL/TLS, security headers, HTTPS redirect, email security (SPF, DMARC, DKIM), content files, cookie security, performance, advanced security, DNS infrastructure, and exposure and recon (exposed files, CMS and library versions, and debug surfaces). Each failed check comes with a specific fix.
What's the difference vs a penetration test?
Ghost Scan is an automated surface-level check, it looks at publicly visible configuration. A penetration test is a manual deep-dive: in our fixed $4,000 engagement a real engineer actively tries to exploit vulnerabilities in your application logic, authentication, and infrastructure.
Is my data stored?
We do not store the address you scan or its result in any database. Our server counts scans from your IP address for up to an hour, to hold the limit of 10 scans an hour. Like every request to this site, a scan is in Cloudflare’s request logs for up to 7 days with your IP address, and with the address you scan when it is part of the link, as in ghosts.lk/scan?url=example.com.
How can I improve my score?
Each failed check includes a specific recommendation. The priority fixes section sorts them by impact so you can tackle the biggest wins first. Use Save as PDF for a printable, shareable action plan.
Talk to an engineer
Email ryan@ghosts.lk or message +94 71 055 5055 on WhatsApp. Ryan replies within 24 hours, Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30).